Trezu for NEAR storage: security, team, audits and real user experiences

Hi NEAR community,

I’m considering Trezu for holding NEAR and would appreciate feedback from its developers, security researchers, and people who already use it.

I’d like to understand the security model and practical risks before deciding whether it is suitable for long-term storage.

1. Who is behind Trezu?

The Terms of Use identify Near Dev Inc as the interface developer and maintainer, while the public repository is hosted under NEAR-DevHub. Who maintains the contracts and production infrastructure? What is Trezu’s organizational relationship with the NEAR Foundation?

2. Who can ultimately control the funds?

For a public treasury holding native NEAR, can anyone outside the treasury’s authorized members move funds, change permissions, or upgrade its contract? Are there factory, administrator, or emergency powers users should understand? How should Governance and Finance approval thresholds be configured?

3. What has actually been audited?

The published Valhalla Security report assesses SputnikDAO2. Which currently deployed contracts and versions does this cover? Are there separate assessments of Trezu’s frontend, backend, Confidential infrastructure, and cross-chain integrations? Where can users find the current status of acknowledged findings and any bug bounty program?

4. How do Public and Confidential treasuries differ in security?

Trezu’s website presents both options and describes a private execution environment for Confidential treasuries. Who operates that infrastructure, and what additional trust assumptions does it introduce? What happens to access and withdrawals if an operator or service becomes unavailable?

5. Who is using Trezu in practice?

The website features testimonials from SWEAT, RHEA Finance, and NearPrime. Could representatives or other users share firsthand experience: which treasury type they use, how long they have used it, and whether they have encountered signing, withdrawal, recovery, or support problems?

6. Can users recover and withdraw independently?

Is there a documented way to manage a treasury through another interface or CLI if trezu.app disappears or becomes inaccessible? What happens if one signer loses access? Which hardware wallets and recovery configurations are currently supported?

For someone primarily holding native NEAR, would you recommend a public Trezu multisig, a Confidential treasury, or a direct hardware-wallet-controlled account—and why?

Links to current documentation, deployed contract addresses, independent security reviews, and firsthand experiences would be especially helpful. Thanks!

Trezu is not profitable app build by NF and manage by NF co-founder friend who didn’t run any profitable project till now.